2

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled Java enough to be protected against drive-by-malware from the internet.

Of course this does not protect me against careless browsing attitude. For example If I post my credit card informations on a wrong/bad website.

The question is if a browser which works only with HTML (HTML5 too) and Images is secure against malware. So is malware infection only possible via scripts, flash-plugin, Java applets etc. (beside the fact that the browser itself could have bugs/leaks but this is not the point in this question)

Let's say I use a text-only browser like links2 for Linux am I save for malware and is this also true for pure HTML and image active in browser?

Improve this question
5
  • 1
    Even links2 may have vulnerabilities!
    – Henning Klevjer
    Jan 17, 2013 at 13:42
  • of course, but I will assume - only for understanding - that the malware does not hit on a browser vulnerability because this is always a point. I think the 100% secure system/programm is not possible
    – Jan Koester
    Jan 17, 2013 at 13:45
  • 1
    You may want to look into something like sandboxie. en.wikipedia.org/wiki/Sandboxie
    – ponsfonze
    Jan 17, 2013 at 13:58
  • thx for the link :-) I know the sandbox mechanism and I often use the chrome browser because it delivers a sandbox for every tab. My question is if it is enough to disable scripts, flash, java etc. or if I need additional protection mechanism software like e.g sandboxie
    – Jan Koester
    Jan 17, 2013 at 14:13
  • When you disable Java you should also disable Adobe Flash. It is just as dangerous and has an even worse track record when it comes to vulnerabilities.
    – Philipp
    Apr 5, 2016 at 8:55

2 Answers 2

Reset to default
3

There is a lot of exploits against libjpeg for sample. Who could be triggered even without javascript.

100% sure don't exist anyway, but. Each functionality present in your host are subject to security faillure and related exploit.

While quantity of faillure existing or maybe existing is related to complexitiy of software, more a functionality is complex (rich), more they are subject to hold some non discovered vulnerabilities.

Most faillures in statics libraries and small utilities like libjpeg or video codecs seem already reviewed, chance to find new non discovered vulnerabilities in such libraries are very smaller than chance to find vulnerabilities in complex programming language (like javascript). Note that in propretary libraries like flash or java, who depend from a hierarchical decision struture may be even lot more considerable.

So the right choice for your configuration is to do between no trust ( su - nobody -c "links" or even better: keep your pc down and cut every cable! ;-) and feel good ( all plugins and codec automatically downloaded and installed... )

Improve this answer
3
  • You bring up a good point, if you load up ANY file that is actually designed to exploit a bug, it woudln't matter if you have Java, Flash, and Javascript disabled within your browser. There are tons of Adobe Acrobat bugs that have been fixed, tons of Word and Excel bugs that have been fixed, most allowed additional software to be installed
    – Ramhound
    Jan 17, 2013 at 16:56
  • 1
    @Ramhound As I know (a little) open-source software, I can say that tons of faillures was fixed in open-source libraries, like libjpeg, ghostscript and gimp-print (for following some exploit using postscript files, for sample). For myself, I've already done both: fixed some bugs of mine, but some other was more worked around. I don't know effectively propretary work, but I suspect that TONS of propretary fix are in fact only work-around.
    – F. Hauri - Give Up GitHub
    Jan 17, 2013 at 17:07
  • Which is exactly my point. I know there was a period of time where I would worry about loading a link on a forum which was clearly an image but not knowing if the image was safe to view. All it takes is for a bug to exist in the file format for somebody to load a malicious file onto your system.
    – Ramhound
    Jan 17, 2013 at 19:05
1

A browser which is configured or designed to accept, parse and render HTML and images only is not enough to protect against malware. It does however considerably reduce your window of exposure.

There has been multiple vulnerabilities in images, html, fonts parsing libraries/engines used by web browsers or others. These vulnerabilities can be sometimes exploited to trigger malware injection and execution.

Improve this answer
3
  • 3
    It also doesn't plug the stupid user hole if this is simply being applied to the computer of someone who is otherwise clueless. They'll still click to see if they won $1 bazillion dollars or to get rid of the viruses that the random website mysteriously detected on their system. But yes, even an educated user can still be compromised even with no-script on, though it is a lot harder.
    – AJ Henderson
    Jan 17, 2013 at 14:32
  • +1 for that. So it is possible to get infected with a malware in a web browser only through an image? Have you a link to some source informations or news about this fact?
    – Jan Koester
    Jan 17, 2013 at 15:07
  • 2
    symantec.com/avcenter/security/Content/13941.html
    – obscure
    Jan 17, 2013 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .